# SPDX-License-Identifier: GPL-2.0-or-later
# SPDX-FileCopyrightText: 2025 GNOME Foundation, Inc.

[Unit]
Description=Parental Controls Web Filtering Daemon
Documentation=man:malcontent-webd(8)
Before=systemd-user-sessions.service

[Service]
ExecStart=/usr/libexec/malcontent-webd
Type=dbus
BusName=org.freedesktop.MalcontentWeb1
NotifyAccess=main
User=malcontent-webd
StateDirectory=malcontent-webd:malcontent-nss
CacheDirectory=malcontent-webd
RestartMode=debug

# Sandboxing
CapabilityBoundingSet=
Environment=GIO_USE_VFS=local
Environment=GVFS_DISABLE_FUSE=1
Environment=GVFS_REMOTE_VOLUME_MONITOR_IGNORE=1
Environment=GSETTINGS_BACKEND=memory
LockPersonality=yes
MemoryDenyWriteExecute=yes
NoNewPrivileges=yes
PrivateDevices=yes
PrivateIPC=yes
PrivatePIDs=yes
PrivateTmp=yes
PrivateUsers=yes
ProcSubset=pid
ProtectClock=yes
DeviceAllow=
ProtectControlGroups=yes
ProtectHome=yes
ProtectHostname=yes
ProtectKernelLogs=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
ProtectProc=invisible
ProtectSystem=strict
RemoveIPC=yes
RestrictNamespaces=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
SystemCallErrorNumber=EPERM
SystemCallFilter=@basic-io @file-system @io-event @ipc @network-io @process @sync flock
# FIXME: Needed to keep nss-myhostname happy (see https://github.com/systemd/systemd/issues/38582):
SystemCallFilter=sigprocmask rt_sigprocmask uname
SystemCallArchitectures=native
UMask=0022

# Need network access to be able to download updated filter lists
PrivateNetwork=no
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6

[Install]
WantedBy=multi-user.target